CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-102045 is an out-of-bounds write vulnerability in the lacpd component of Juniper Networks Junos OS Evolved. It allows a Layer-2-adjacent attacker to cause a denial of service by sending a crafted frame to an LACP-enabled aggregated-Ethernet member port. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption without confidentiality or integrity impact.

CVE-2026-102017 is an out-of-bounds write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated attacker to cause a denial of service on the routing plane by sending crafted Auto-RP mapping announcements when Auto-RP mapping is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 6.5, indicating a medium severity impact focused on availability disruption.

CVE-2026-101934 is an out-of-bounds write vulnerability in the eventd component of Juniper Networks Junos OS and Junos OS Evolved. A local attacker with high privileges can send a specially crafted packet to the eventd relay service to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.4 (medium severity). Multiple versions of Junos OS and Junos OS Evolved are affected as specified. There is no explicit vendor advisory or patch information provided in the input data.

CVE-2026-103993 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can send a crafted set of BGP communities including a graceful-shutdown sender community to cause the rpd process to crash, resulting in a denial-of-service (DoS). This affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases.

CVE-2026-101960 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved. It affects specific QFX series devices configured for BGP global-load-balancing with more than 128 ECMP next-hops. Exploitation can cause the rpd process to crash, resulting in denial of service. The vulnerability has a CVSS score of 6.5, indicating medium severity. No known exploits are reported in the wild. Affected versions span multiple releases prior to certain fixed builds as specified by Juniper.

CVE-2026-49206 is an integer overflow or wraparound vulnerability in the rapidcsv C++ CSV parser library versions prior to 8.99. The issue arises from converting size_t indexes to int before adding them to std::vector iterators on 64-bit systems. When handling CSV matrices with more than 2^31 elements, an index exceeding INT_MAX can wrap to a negative offset, causing undefined behavior, heap memory corruption, or a crash. Exploitation requires extremely large in-memory CSV documents, making typical use cases unlikely to be affected. The vulnerability is fixed in version 8.99.

CVE-2026-110734 is a heap out-of-bounds write vulnerability in Godot Engine through version 4.7.2. It occurs in the Radiance HDR (.hdr) image decoder due to improper validation of run-length decoding instructions, allowing crafted .hdr files to write beyond allocated heap memory. This flaw is triggered automatically when importing a malicious .hdr file and affects runtime in exported projects loading untrusted .hdr images. The vendor considers this outside their current threat model and does not classify it as a security issue.

CVE-2026-86573 is an out-of-bounds write vulnerability in the Hitachi Disk Array Driver for AIX and the Hitachi Disk Array Driver for Virtual I/O Server. It affects specific versions starting from 01-00 up to but not including 01-23-/A for AIX, and from 01-04 up to but not including 01-23-/A for the Virtual I/O Server. The vulnerability has a medium severity with a CVSS score of 5.1 and can cause integrity loss and high availability impact without confidentiality compromise.

CVE-2026-84419 is an out-of-bounds write vulnerability in Citrix Workspace app for Windows. It affects versions before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1. The vulnerability has a CVSS 4.0 base score of 6.8, indicating a medium severity level. It requires local access with low privileges and no user interaction is needed. There are no known exploits in the wild at this time.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects multiple versions up to 16.0.7 and 15.1.8. No patch or remediation details are provided in the input data.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 16.0.7 and 15.1.8. The CVSS v3.1 base score is 7.8, indicating high severity.

Adobe Bridge contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 16.0.7 and 15.1.8. The CVSS 3.1 base score is 7.8, indicating a high severity issue.

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Substance 3D Sampler contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 6.0.3. The CVSS v3.1 base score is 7.8, indicating a high severity issue.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS score is 7.8, indicating high severity.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating a high severity issue.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. It has a high severity with a CVSS score of 7.8.

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that may allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS v3.1 base score is 7.8, indicating a high severity level.

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS v3.1 base score is 7.8, indicating high severity.